ci-code.yaml

name: Lint and Test Code

on:
  pull_request:
    branches:
      - main
    paths:
      - bin/**
      - examples/**
      - src/**
      - Cargo.*
      - rust-toolchain.toml
      - .github/workflows/ci-code.yaml

permissions:
  contents: read # Default token to read

jobs:
  setup-cargo-make:
    name: setup-cargo-make
    runs-on: ubuntu-latest
    outputs:
      cargo_make_version: ${{ steps.get-version.outputs.cargo_make_version }}
      cache-key: ${{ steps.cache-cargo-make.outputs.cache-primary-key }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - name: Fetch latest cargo-make version
        id: get-version
        run: |
          VERSION=$(curl -s \
            -H "User-Agent: github.com/edera-dev/styrolite (contact: support@edera.dev>)" \
            https://crates.io/api/v1/crates/cargo-make | jq -r '.crate.max_stable_version')
          echo "cargo_make_version=$VERSION" >> $GITHUB_OUTPUT

      - name: Cache cargo-make binary
        id: cache-cargo-make
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: ~/.cargo/bin/cargo-make
          key: ${{ runner.os }}-cargo-make-${{ steps.get-version.outputs.cargo_make_version }}

      - name: Install cargo-make if missing or outdated
        if: steps.cache-cargo-make.outputs.cache-hit != 'true'
        run: |
          cargo install cargo-make --version "${CARGO_MAKE_VERSION}" --force
        env:
          CARGO_MAKE_VERSION: ${{ steps.get-version.outputs.cargo_make_version }}

      - name: Verify cargo-make
        run: cargo make --version

  rustfmt:
    name: rustfmt
    runs-on: ubuntu-latest
    needs: setup-cargo-make
    steps:
      - name: harden runner
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - name: checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
          persist-credentials: false

      - name: Restore cached cargo-make
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: ~/.cargo/bin/cargo-make
          key: ${{ runner.os }}-cargo-make-${{ needs.setup-cargo-make.outputs.cargo_make_version }}

      - name: 'cargo fmt'
        run: cargo make format-check

  shfmt:
    name: shfmt
    runs-on: ubuntu-latest
    needs: setup-cargo-make
    steps:
      - name: harden runner
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - name: checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
          persist-credentials: false

      - name: Restore cached cargo-make
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: ~/.cargo/bin/cargo-make
          key: ${{ runner.os }}-cargo-make-${{ needs.setup-cargo-make.outputs.cargo_make_version }}

      - name: shfmt
        run: |
          GOBIN=/usr/local/bin go install mvdan.cc/sh/v3/cmd/shfmt@latest
          if ! cargo make shfmt; then
            echo ""
            echo "Please run \`cargo make shfmt-write\`"
            exit 1
          fi

  shellcheck:
    name: shellcheck
    runs-on: ubuntu-latest
    needs: setup-cargo-make
    steps:
      - name: harden runner
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - name: checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
          persist-credentials: false

      - name: Restore cached cargo-make
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: ~/.cargo/bin/cargo-make
          key: ${{ runner.os }}-cargo-make-${{ needs.setup-cargo-make.outputs.cargo_make_version }}

      - name: shellcheck
        run: cargo make shellcheck

  full-build:
    runs-on: ubuntu-latest
    needs: setup-cargo-make
    strategy:
      fail-fast: false
      matrix:
        arch:
        - x86_64
    env:
      TARGET_ARCH: "${{ matrix.arch }}"
    name: 'Full build linux-${{ matrix.arch }}'
    steps:
      - name: harden runner
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - name: checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
          persist-credentials: false

      - name: Restore cached cargo-make
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: ~/.cargo/bin/cargo-make
          key: ${{ runner.os }}-cargo-make-${{ needs.setup-cargo-make.outputs.cargo_make_version }}

      - name: cargo build
        run: cargo make build

  full-test:
    runs-on: ubuntu-latest
    needs: setup-cargo-make
    strategy:
      fail-fast: false
      matrix:
        arch:
        - x86_64
    env:
      TARGET_ARCH: "${{ matrix.arch }}"
    name: 'Full test linux-${{ matrix.arch }}'
    steps:
      - name: harden runner
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - name: checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
          persist-credentials: false

      - name: Restore cached cargo-make
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: ~/.cargo/bin/cargo-make
          key: ${{ runner.os }}-cargo-make-${{ needs.setup-cargo-make.outputs.cargo_make_version }}

      - name: 'cargo test'
        run: cargo make test

  full-clippy:
    runs-on: ubuntu-latest
    needs: setup-cargo-make
    strategy:
      matrix:
        arch:
        - x86_64
    env:
      TARGET_ARCH: "${{ matrix.arch }}"
    name: 'Full clippy linux-${{ matrix.arch }}'
    steps:
      - name: harden runner
        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
        with:
          egress-policy: audit

      - name: checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
          persist-credentials: false

      - name: Restore cached cargo-make
        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
        with:
          path: ~/.cargo/bin/cargo-make
          key: ${{ runner.os }}-cargo-make-${{ needs.setup-cargo-make.outputs.cargo_make_version }}

      - name: 'cargo clippy'
        run: cargo make clippy